Re: SV: Honeypot detection and countermeasures

Well, that's a great way to think about it - as a test of your countermeasures. In fact, there are MANY ways to both remotely and locally detect various breeds of honeypots. VMWare, for example, uses a particular range of MAC addresses, among other things. I always find it funny when people use VMWare as a security measure.

But (imho) it's a truly RARE penetration test team that will notice some of these subtle things, and basically no pentration test teams can remotely discover a honeypot - the technology for doing so just isn't public enough yet. (Well, I just gave away that MAC address trick, but it's limited to the local net, and there are lots of other, better tricks).

Dave Aitel
Immunity, Inc.
http://www.immunitysec.com/

>
> But...the last thing, since that was commented (but was removed from the

You're a pen tester, but is google.com still your R&D team? Now you can get trustworthy commercial-grade exploits and the latest techniques from a world-class research group.

Visit us at: www.coresecurity.com/promos/sf_ept1 or call 617-399-6980